88038[.]xyz

Analysis of 88038.xyz indicates a brand‑impersonation campaign targeting Bet365. The domain was registered on 4 December 2025 through Gname.com Pte. Ltd. and resolves to IP 45.196.247.178, an address hosted by Nebula Global LLC in Hong Kong (AS140224). The site presents the page title “welcome‑BET365”, a clear indication of attempted brand mimicry. VirusTotal records show that 17 of 93 scanning engines flagged the domain, reflecting a moderate detection consensus. The domain appears in four AlienVault OTX pulses and is listed on at least one public security blocklist, confirming community awareness of its malicious nature.

Gridinsoft assigned a trust score of 0 out of 100, and the SSL certificate is identified as version R13, suggesting a self‑signed or low‑trust certificate. The service has been taken offline, and PhishDestroy reports the domain as blocked. The campaign is categorized as a crypto‑gambling scam, implying that victims may be lured into depositing cryptocurrency under the guise of Bet365 betting services. Uncertainty remains regarding the exact payload delivered, the presence of any credential‑harvesting forms, and whether additional infrastructure such as command‑and‑control servers is employed, as no page content beyond the title has been publicly captured. The offline status currently returns no HTTP response, preventing further automated content retrieval.

Because the site is no longer reachable, active verification of malicious scripts or redirection chains is not possible at this time. Defenders should add 88038.xyz to domain blocklists, monitor traffic to the associated IP address, and enforce DNS filtering for the domain. Organizations that use Bet365 for legitimate purposes should educate users about the risk of unsolicited links referencing the brand and verify URLs before entering credentials or funds.